T-Mobile, Verizon, AT&T Stop SMS Hijacks After Motherboard Investigation | Hacker News Reader

T-Mobile, Verizon, AT&T Stop SMS Hijacks After Motherboard Investigation

vice.com

49 points1cvmask8 comments

At long last. F-you, T-Mobile. [0]

[0]: https://simon.medium.com/mobile-twitter-hacked-please-help-2...

In this case, I also blame Twitter for forcing new accounts to add a phone number (otherwise the account gets locked for "automated behavior" shortly after account creation, also happened to me personally).

https://popzazzle.blogspot.com/2017/09/are-twitters-locked-a...

Technically speaking, how does this even work?

And non-technically speaking, how does a major flaw like this not get spotted and patched when the architecture for SMS was being initially designed? Or is this just one of those cases where no-one was willing/able to consider security (it where it wasn't even a usual consideration)?

Out of all the technologies I use on a day-to-day basis, I feel like telephony networks and transmission is the area I know the least about.

In order to allow the exchange of SMS between networks, a system of SMS interconnect was created in the late 90s. Essentially, each company that wants to exchange SMS will query a database to find out what carrier is responsible for delivering SMS to a given number. (There are a lot of moving parts and several databases, varying by country code, but you get the idea.)

What services like this do is enable someone who owns a number that is not ordinarily enabled for SMS (POTS, VoIP, toll free/WATS) to enter their number into the SMS routing system and tell other carriers to deliver SMS to a service provider (one that can handle the inbound SMS traffic and display it on a web portal, for instance) of their choosing.

The flaw is when a SMS-enabled number can have its instructions overwritten by a service like this so that messages are routed where they shouldn’t go. As all mobile numbers are considered SMS-enabled by default and only the owning carrier should be the destination, this is a flaw. (Yes, I can think of some scenarios where you might want your mobile number SMS messages going elsewhere, but that’s dead for now.)

More specifically, the flaw is to do it on the back of an easily-faked, CYA letter of authority.

>More specifically, the flaw is to do it on the back of an easily-faked, CYA letter of authority.

The company the OP used bears a large part of the responsibility for the issue due to the intentional or negligent lack of validation.

Several years ago, I built an application that offered similar ability to the one that caused the recent ruckus. In our case, we worked with industry groups to define an acceptable flow, which led to a one where we initiated a voice call to the customer that read a numeric code to them, which they had to enter as part of the registration process. We also checked each number to make sure that we were ONLY registering landlines and not mobile, toll-free, or other MVNO-associated numbers like Google Voice, etc. (We did support toll-free, but that required written LOA and manual verification with toll-free # registrar).

The surprising part to me in the carrier's response was that they weren't already periodically reclaiming SMS routing for their numbers. Over the course of testing, I'd accidentally claimed my own cell # (Verizon) or the cell # (T-Mobile) of one of our test phones, and proper routing was always restored within a week for Verizon, and within a day or two for T-Mobile.

Yet another reason phone numbers shouldn't be used to identify or secure anything.

Thanks, Ajit Pai!

I see you are being downvoted but the man asked for it with the Harlem shake video [0]. I frequently get downvoted here for truth

[0]And just for HN any ol YouTube link will suffice: https://youtu.be/LFhT6H6pRWg

Reply on news.ycombinator.com